DETECTING HIGH RISK CHROME EXTENSIONS WITH OSQUERY

Summary from the TLDR InfoSec newsletter

The Quiq team undertook a project to identify malicious or overprivileged Chrome extensions using osquery. They developed a query that would surface the uid of any Chrome extension with clipboardWrite, all_urls, tabs, or cookies permissions. The team then examined the Chrome extension store page of each application and allowlisted or removed them.